ABSTRACT OF THE DISCLOSURE 

A method and system are disclosed to provide secure key selection using a secure 
device in a watercrypting environment. A license containing a product key of a 
watercrypted content and a client identifier is transmitted to a secure device for storage. 
An entitlement control message containing multiple content keys associated with the 
watercrypted content is further transmitted to the secure device, together with a request to 
provide a session content key from the multiple content keys, the session content key to 
be used to decrypt the watercrypted content. Finally, the session content key is received 
from the secure device in response to the request. 
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